fix(v3.8.5): 9 bug fixes from GitHub triage

CHANGELOG.md

@@ -2,6 +2,25 @@
 
 ## [Unreleased]
 
+## [3.8.5] — 2026-05-26
+
+### 🔒 Security
+
+- **authz:** redirect `/home` and `/home/:path*` to `/login` when unauthenticated — Next.js middleware matcher omitted `/home`, so any visit reached the page directly on `REQUIRE_LOGIN` deployments (#2712)
+
+### 🔧 Bug Fixes
+
+- **mcp:** break callLogs ↔ compliance ESM cycle that deadlocks the bundled MCP server on Node.js 24 — extract no-log state to `compliance/noLog.ts`, switch callers to the leaf module, keep `compliance/index.ts` re-exports for backwards compat (#2650)
+- **deepseek:** guard PoW solver Web Worker handler so `require()` no longer throws `ReferenceError: onmessage is not defined` under Node strict mode (#2724)
+- **combos:** include no-auth providers (FreeAIAPIKey, BluesMinds, FreeModel.dev, opencode, …) in the combo builder picker — they were invisible because they never get rows in `provider_connections` (#2737)
+- **translator:** allow the `web_search` server-tool family (`web_search_20250305`, `web_search_20250101`, plain `web_search`) in the Responses API translator and preserve the original versioned name on output (#2695)
+- **oauth:** register the missing `trae` provider with `import_token` flow so the Trae IDE no longer 500s during token import (#2658)
+- **model:** merge settings-based aliases with the legacy DB alias namespace so aliases set via the Settings UI (e.g. `gpt-5.4 → cx/gpt-5.4`) are honored instead of being overridden by provider inference (#2618, #2208)
+- **kiro:** fall back to `document.execCommand("copy")` when the Clipboard API is unavailable (HTTP/non-secure contexts), so the "Copy authorization link" button works on LAN deployments (#2689)
+- **cli:** raise `omniroute serve` ready timeout from 20s to 60s and add a TCP-listening fallback so Windows users no longer get phantom timeouts during slow Next.js cold start (#2460)
+
+## [Unreleased]
+
 ### ✨ New Features
 
 - **proxy:** serverless relay endpoints with rate limiting (#2734)

bin/cli/commands/serve.mjs

@@ -269,7 +269,7 @@ async function runWithSupervisor(
   });
 
   if (!showLog) {
-    waitForServer(dashboardPort, 20000).then(async (up) => {
+    waitForServer(dashboardPort, 60000).then(async (up) => {
       if (up) {
         if (useTray) await maybeStartTray(dashboardPort, apiPort, supervisor);
         onReady(dashboardPort, apiPort, noOpen);

bin/cli/utils/pid.mjs

@@ -61,16 +61,50 @@ export function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
-export async function waitForServer(port, timeout = 15000) {
+// #2460: Default raised from 15s to 60s so Windows users (slower Next.js
+// cold start due to filesystem watchers, antivirus, etc.) get a working
+// "server ready" signal instead of a phantom timeout while the server is
+// still booting. TCP fallback marks the server as ready when the port
+// has been listening for >= 3s consecutively but /api/monitoring/health
+// has not yet been mounted — common during dev cold start.
+export async function waitForServer(port, timeout = 60000) {
   const start = Date.now();
+  let tcpListeningSince = null;
   while (Date.now() - start < timeout) {
     try {
       const res = await fetch(`http://localhost:${port}/api/monitoring/health`, {
         signal: AbortSignal.timeout(2000),
       });
       if (res.ok) return true;
-    } catch {}
+      // Server responded but health endpoint is not ready yet — keep
+      // polling, but the fact that we got a response means TCP is open.
+      if (tcpListeningSince === null) tcpListeningSince = Date.now();
+    } catch {
+      const listening = await isPortListening(port).catch(() => false);
+      if (listening) {
+        if (tcpListeningSince === null) tcpListeningSince = Date.now();
+        if (Date.now() - tcpListeningSince >= 3000) return true;
+      } else {
+        tcpListeningSince = null;
+      }
+    }
     await sleep(500);
   }
   return false;
 }
+
+async function isPortListening(port) {
+  const net = await import("node:net");
+  return new Promise((resolve) => {
+    const socket = net.connect({ host: "127.0.0.1", port, timeout: 1000 });
+    const finish = (ok) => {
+      try {
+        socket.destroy();
+      } catch {}
+      resolve(ok);
+    };
+    socket.once("connect", () => finish(true));
+    socket.once("error", () => finish(false));
+    socket.once("timeout", () => finish(false));
+  });
+}

docs/i18n/ar/CHANGELOG.md

@@ -4,6 +4,25 @@
 
 ---
 
+## [3.8.5] — 2026-05-26
+
+### 🔒 Security
+
+- **authz:** redirect `/home` and `/home/:path*` to `/login` when unauthenticated (#2712)
+
+### 🔧 Bug Fixes
+
+- **mcp:** break callLogs ↔ compliance ESM cycle that deadlocks the bundled MCP server on Node.js 24 (#2650)
+- **deepseek:** guard PoW solver Web Worker handler under Node strict mode (#2724)
+- **combos:** include no-auth providers in the combo builder picker (#2737)
+- **translator:** allow the `web_search` server-tool family in the Responses API translator (#2695)
+- **oauth:** register the missing `trae` provider with `import_token` flow (#2658)
+- **model:** merge settings-based aliases with the legacy DB alias namespace (#2618, #2208)
+- **kiro:** clipboard fallback for HTTP / non-secure contexts (#2689)
+- **cli:** raise `omniroute serve` ready timeout to 60s with TCP fallback for Windows cold start (#2460)
+
+---
+
 ## [Unreleased]
 
 ### ✨ New Features

docs/i18n/az/CHANGELOG.md

@@ -4,6 +4,25 @@
 
 ---
 
+## [3.8.5] — 2026-05-26
+
+### 🔒 Security
+
+- **authz:** redirect `/home` and `/home/:path*` to `/login` when unauthenticated (#2712)
+
+### 🔧 Bug Fixes
+
+- **mcp:** break callLogs ↔ compliance ESM cycle that deadlocks the bundled MCP server on Node.js 24 (#2650)
+- **deepseek:** guard PoW solver Web Worker handler under Node strict mode (#2724)
+- **combos:** include no-auth providers in the combo builder picker (#2737)
+- **translator:** allow the `web_search` server-tool family in the Responses API translator (#2695)
+- **oauth:** register the missing `trae` provider with `import_token` flow (#2658)
+- **model:** merge settings-based aliases with the legacy DB alias namespace (#2618, #2208)
+- **kiro:** clipboard fallback for HTTP / non-secure contexts (#2689)
+- **cli:** raise `omniroute serve` ready timeout to 60s with TCP fallback for Windows cold start (#2460)
+
+---
+
 ## [Unreleased]
 
 ### ✨ New Features

docs/i18n/bg/CHANGELOG.md

@@ -4,6 +4,25 @@
 
 ---
 
+## [3.8.5] — 2026-05-26
+
+### 🔒 Security
+
+- **authz:** redirect `/home` and `/home/:path*` to `/login` when unauthenticated (#2712)
+
+### 🔧 Bug Fixes
+
+- **mcp:** break callLogs ↔ compliance ESM cycle that deadlocks the bundled MCP server on Node.js 24 (#2650)
+- **deepseek:** guard PoW solver Web Worker handler under Node strict mode (#2724)
+- **combos:** include no-auth providers in the combo builder picker (#2737)
+- **translator:** allow the `web_search` server-tool family in the Responses API translator (#2695)
+- **oauth:** register the missing `trae` provider with `import_token` flow (#2658)
+- **model:** merge settings-based aliases with the legacy DB alias namespace (#2618, #2208)
+- **kiro:** clipboard fallback for HTTP / non-secure contexts (#2689)
+- **cli:** raise `omniroute serve` ready timeout to 60s with TCP fallback for Windows cold start (#2460)
+
+---
+
 ## [Unreleased]
 
 ### ✨ New Features

docs/i18n/bn/CHANGELOG.md

@@ -4,6 +4,25 @@
 
 ---
 
+## [3.8.5] — 2026-05-26
+
+### 🔒 Security
+
+- **authz:** redirect `/home` and `/home/:path*` to `/login` when unauthenticated (#2712)
+
+### 🔧 Bug Fixes
+
+- **mcp:** break callLogs ↔ compliance ESM cycle that deadlocks the bundled MCP server on Node.js 24 (#2650)
+- **deepseek:** guard PoW solver Web Worker handler under Node strict mode (#2724)
+- **combos:** include no-auth providers in the combo builder picker (#2737)
+- **translator:** allow the `web_search` server-tool family in the Responses API translator (#2695)
+- **oauth:** register the missing `trae` provider with `import_token` flow (#2658)
+- **model:** merge settings-based aliases with the legacy DB alias namespace (#2618, #2208)
+- **kiro:** clipboard fallback for HTTP / non-secure contexts (#2689)
+- **cli:** raise `omniroute serve` ready timeout to 60s with TCP fallback for Windows cold start (#2460)
+
+---
+
 ## [Unreleased]
 
 ### ✨ New Features

docs/i18n/cs/CHANGELOG.md

@@ -4,6 +4,25 @@
 
 ---
 
+## [3.8.5] — 2026-05-26
+
+### 🔒 Security
+
+- **authz:** redirect `/home` and `/home/:path*` to `/login` when unauthenticated (#2712)
+
+### 🔧 Bug Fixes
+
+- **mcp:** break callLogs ↔ compliance ESM cycle that deadlocks the bundled MCP server on Node.js 24 (#2650)
+- **deepseek:** guard PoW solver Web Worker handler under Node strict mode (#2724)
+- **combos:** include no-auth providers in the combo builder picker (#2737)
+- **translator:** allow the `web_search` server-tool family in the Responses API translator (#2695)
+- **oauth:** register the missing `trae` provider with `import_token` flow (#2658)
+- **model:** merge settings-based aliases with the legacy DB alias namespace (#2618, #2208)
+- **kiro:** clipboard fallback for HTTP / non-secure contexts (#2689)
+- **cli:** raise `omniroute serve` ready timeout to 60s with TCP fallback for Windows cold start (#2460)
+
+---
+
 ## [Unreleased]
 
 ### ✨ New Features

docs/i18n/da/CHANGELOG.md

@@ -4,6 +4,25 @@
 
 ---
 
+## [3.8.5] — 2026-05-26
+
+### 🔒 Security
+
+- **authz:** redirect `/home` and `/home/:path*` to `/login` when unauthenticated (#2712)
+
+### 🔧 Bug Fixes
+
+- **mcp:** break callLogs ↔ compliance ESM cycle that deadlocks the bundled MCP server on Node.js 24 (#2650)
+- **deepseek:** guard PoW solver Web Worker handler under Node strict mode (#2724)
+- **combos:** include no-auth providers in the combo builder picker (#2737)
+- **translator:** allow the `web_search` server-tool family in the Responses API translator (#2695)
+- **oauth:** register the missing `trae` provider with `import_token` flow (#2658)
+- **model:** merge settings-based aliases with the legacy DB alias namespace (#2618, #2208)
+- **kiro:** clipboard fallback for HTTP / non-secure contexts (#2689)
+- **cli:** raise `omniroute serve` ready timeout to 60s with TCP fallback for Windows cold start (#2460)
+
+---
+
 ## [Unreleased]
 
 ### ✨ New Features

docs/i18n/de/CHANGELOG.md

@@ -4,6 +4,25 @@
 
 ---
 
+## [3.8.5] — 2026-05-26
+
+### 🔒 Security
+
+- **authz:** redirect `/home` and `/home/:path*` to `/login` when unauthenticated (#2712)
+
+### 🔧 Bug Fixes
+
+- **mcp:** break callLogs ↔ compliance ESM cycle that deadlocks the bundled MCP server on Node.js 24 (#2650)
+- **deepseek:** guard PoW solver Web Worker handler under Node strict mode (#2724)
+- **combos:** include no-auth providers in the combo builder picker (#2737)
+- **translator:** allow the `web_search` server-tool family in the Responses API translator (#2695)
+- **oauth:** register the missing `trae` provider with `import_token` flow (#2658)
+- **model:** merge settings-based aliases with the legacy DB alias namespace (#2618, #2208)
+- **kiro:** clipboard fallback for HTTP / non-secure contexts (#2689)
+- **cli:** raise `omniroute serve` ready timeout to 60s with TCP fallback for Windows cold start (#2460)
+
+---
+
 ## [Unreleased]
 
 ### ✨ New Features

docs/i18n/es/CHANGELOG.md

@@ -4,6 +4,25 @@
 
 ---
 
+## [3.8.5] — 2026-05-26
+
+### 🔒 Security
+
+- **authz:** redirect `/home` and `/home/:path*` to `/login` when unauthenticated (#2712)
+
+### 🔧 Bug Fixes
+
+- **mcp:** break callLogs ↔ compliance ESM cycle that deadlocks the bundled MCP server on Node.js 24 (#2650)
+- **deepseek:** guard PoW solver Web Worker handler under Node strict mode (#2724)
+- **combos:** include no-auth providers in the combo builder picker (#2737)
+- **translator:** allow the `web_search` server-tool family in the Responses API translator (#2695)
+- **oauth:** register the missing `trae` provider with `import_token` flow (#2658)
+- **model:** merge settings-based aliases with the legacy DB alias namespace (#2618, #2208)
+- **kiro:** clipboard fallback for HTTP / non-secure contexts (#2689)
+- **cli:** raise `omniroute serve` ready timeout to 60s with TCP fallback for Windows cold start (#2460)
+
+---
+
 ## [Unreleased]
 
 ### ✨ New Features

docs/i18n/fa/CHANGELOG.md

@@ -4,6 +4,25 @@
 
 ---
 
+## [3.8.5] — 2026-05-26
+
+### 🔒 Security
+
+- **authz:** redirect `/home` and `/home/:path*` to `/login` when unauthenticated (#2712)
+
+### 🔧 Bug Fixes
+
+- **mcp:** break callLogs ↔ compliance ESM cycle that deadlocks the bundled MCP server on Node.js 24 (#2650)
+- **deepseek:** guard PoW solver Web Worker handler under Node strict mode (#2724)
+- **combos:** include no-auth providers in the combo builder picker (#2737)
+- **translator:** allow the `web_search` server-tool family in the Responses API translator (#2695)
+- **oauth:** register the missing `trae` provider with `import_token` flow (#2658)
+- **model:** merge settings-based aliases with the legacy DB alias namespace (#2618, #2208)
+- **kiro:** clipboard fallback for HTTP / non-secure contexts (#2689)
+- **cli:** raise `omniroute serve` ready timeout to 60s with TCP fallback for Windows cold start (#2460)
+
+---
+
 ## [Unreleased]
 
 ### ✨ New Features

docs/i18n/fi/CHANGELOG.md

@@ -4,6 +4,25 @@
 
 ---
 
+## [3.8.5] — 2026-05-26
+
+### 🔒 Security
+
+- **authz:** redirect `/home` and `/home/:path*` to `/login` when unauthenticated (#2712)
+
+### 🔧 Bug Fixes
+
+- **mcp:** break callLogs ↔ compliance ESM cycle that deadlocks the bundled MCP server on Node.js 24 (#2650)
+- **deepseek:** guard PoW solver Web Worker handler under Node strict mode (#2724)
+- **combos:** include no-auth providers in the combo builder picker (#2737)
+- **translator:** allow the `web_search` server-tool family in the Responses API translator (#2695)
+- **oauth:** register the missing `trae` provider with `import_token` flow (#2658)
+- **model:** merge settings-based aliases with the legacy DB alias namespace (#2618, #2208)
+- **kiro:** clipboard fallback for HTTP / non-secure contexts (#2689)
+- **cli:** raise `omniroute serve` ready timeout to 60s with TCP fallback for Windows cold start (#2460)
+
+---
+
 ## [Unreleased]
 
 ### ✨ New Features

docs/i18n/fr/CHANGELOG.md

@@ -4,6 +4,25 @@
 
 ---
 
+## [3.8.5] — 2026-05-26
+
+### 🔒 Security
+
+- **authz:** redirect `/home` and `/home/:path*` to `/login` when unauthenticated (#2712)
+
+### 🔧 Bug Fixes
+
+- **mcp:** break callLogs ↔ compliance ESM cycle that deadlocks the bundled MCP server on Node.js 24 (#2650)
+- **deepseek:** guard PoW solver Web Worker handler under Node strict mode (#2724)
+- **combos:** include no-auth providers in the combo builder picker (#2737)
+- **translator:** allow the `web_search` server-tool family in the Responses API translator (#2695)
+- **oauth:** register the missing `trae` provider with `import_token` flow (#2658)
+- **model:** merge settings-based aliases with the legacy DB alias namespace (#2618, #2208)
+- **kiro:** clipboard fallback for HTTP / non-secure contexts (#2689)
+- **cli:** raise `omniroute serve` ready timeout to 60s with TCP fallback for Windows cold start (#2460)
+
+---
+
 ## [Unreleased]
 
 ### ✨ New Features

docs/i18n/gu/CHANGELOG.md

@@ -4,6 +4,25 @@
 
 ---
 
+## [3.8.5] — 2026-05-26
+
+### 🔒 Security
+
+- **authz:** redirect `/home` and `/home/:path*` to `/login` when unauthenticated (#2712)
+
+### 🔧 Bug Fixes
+
+- **mcp:** break callLogs ↔ compliance ESM cycle that deadlocks the bundled MCP server on Node.js 24 (#2650)
+- **deepseek:** guard PoW solver Web Worker handler under Node strict mode (#2724)
+- **combos:** include no-auth providers in the combo builder picker (#2737)
+- **translator:** allow the `web_search` server-tool family in the Responses API translator (#2695)
+- **oauth:** register the missing `trae` provider with `import_token` flow (#2658)
+- **model:** merge settings-based aliases with the legacy DB alias namespace (#2618, #2208)
+- **kiro:** clipboard fallback for HTTP / non-secure contexts (#2689)
+- **cli:** raise `omniroute serve` ready timeout to 60s with TCP fallback for Windows cold start (#2460)
+
+---
+
 ## [Unreleased]
 
 ### ✨ New Features